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FOREWORD 


The  Naval  Surface  Weapons  Center/Dahlgren  Laboratory  (NSWC/DL)  has 
been  involved  for  a number  of  years  in  attempts  to  reduce  the  incidence 
of  in-bore  premature  explosion  of  gun-launched,  high-explosive  projec- 
tiles. In  the  process,  a number  of  innovative  and  advanced  techniques 
have  been  developed  for  accident  investigation  and  development  program 
safety  testing.  This  report  discusses  the  basic  approach  used  in  one 
of  those  techniques  called  Faulty  Unit  Testing. 

This  report  has  been  reviewed  and  approved  by  S.  H.  McElroy,  Head, 
Weapons  Safety  Division. 
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BACKGROUND 


Weapon  developers  are  charged  with  the  responsibility  for  assuring 
that  new  systems  will  be  relatively  free  of  hazardous  events  during 
testing  and  Fleet  use.  Normal  design  and  test  practices  provide  a 
reasonable  means  for  eliminating  hazardous  events  that  would  otherwise 
occur  frequently  (more  frequently  than  one  occurrence  per  100  opportu- 
nities) . The  developer  is  also  charged  with  the  anticipation  and 
resolution  of  hazards  that  are,  at  best,  rare  occurrences  (less  fre- 
quently than  one  occurrence  per  100  opportunities) . Inasmuch  as  the 
systems  considered  here  are  new,  there  exists  no  historical  data  to 
provide  guidance  about  what  can  go  wrong,  although  experience  with 
similar  systems  can  frequently  point  out  likely  areas.  Formalized 
safety  analysis  techniques,  such  as  Failure  Modes  and  Effects  and  Fault 
Tree  and  Preliminary  Hazard  Analyses  have  been  developed  in  recent  years 
to  provide  valuable  assistance  in  identifying  hazard-producing  conditions 
in  systems  where  the  results  of  faults  and  failures  can  be  predicted 
from  common  technical  experience  (e.g.,  mechanical,  electrical,  and 
pneumatic  systems).  In  the  area  of  explosive  material  response,  however, 
the  formalized  techniques  have  not  yet  identified  all  known  causes  of 
explosive  hazards.  The  prediction  of  explosive  response  to  various 
energy  inputs  has  not  reached  the  level  of  predictability  of  mechanical 
and  electrical  systems.  The  most  productive  techniques  available  are 
those  used  in  "after-the-fact"  explosive  accident  investigation  where 
various  postulated  causes  are  introduced  in  an  attempt  to  recreate  the 
accident.  The  "Faulty  Unit  Testing  Concept"  uses  this  technique  to 
identify  potential  accident  caus  5 for  new  systems  before  the  fact. 

The  concept  of  fault  testing  arises  from  the  need  to  find  a 
rational  means  for  incorporating  past  experience  into  new  systems  with- 
out burdening  the  new  system  with  "fears  and  superstitions."  The  Faulty 
Unit  Testing  Concept  is  able  to  provide  assistance  in  orienting  the 
priorities  for  safety  requirements  in  such  a manner  that  the  "most 
likely"  hazards  can  be  addressed  first.  Unless  an  organized  approach 
is  followed  for  separating  the  highly  likely  hazard  causes  from  those 
not  so  likely,  accident  statistics  will  not  improve.  Except  by  testing, 
one  cannot  decide,  for  example,  which  defect  in  a gun-fired  projectile 
(explosive  in  base  plug  threads,  missing  base  plug  gas  check,  or  gaps 
and  low-density  explosive)  is  the  most  important  one  to  attack  with 
limited  resources. 

Faulty  Unit  Testing  is  not  expected  to  be  of  practical  value  in 
all  system  development  programs.  In  general,  the  greatest  reward  will 
be  in  programs  where  there  is  a potential  hazard  induced  by  a repetitious 
extreme  environment  (e.g.,  in-bore  prematures  for  a gun-launched 
projectile)  and  where  units  that  can  be  tested  are  relatively  inexpensive 
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A guided  missile,  for  example,  would  gain  very  little  from  Faulty  Unit 
Testing  since  there  is  no  repetitious  explosive  hazard  which  confines 
itself  to  a specific  logistic  event,  and  the  test  unit  would  be  too 
expensive  to  conduct  a meaningful  test  series.  Therefore,  this  method 
is  not  proposed  as  a solution  for  all  safety  problems. 


OBJECTIVE 


The  objective  of  this  report  is  to  present  the  basic  philosophy  of 
Faulty  Unit  Safety  Testing  and  to  illustrate  its  practical  applications. 


HISTORICAL  SAFETY  TESTING  TECHNIQUES 


Frequently,  weapon  developers  will  decide  that  normal  functioning 
tests  of  their  system  will  suffice  for  safety  purposes,  with  no  attempts 
to  overtest  or  look  for  possible  weaknesses.  This  is  a shortsighted 
view,  proving  only  that  well-made  units  function  properly  under  ideal 
conditions.  Safety  investigators  must  always  prepare  for  the  worst  case. 

A development  test  program  consisting  of  testing  only  "good  units"  wou3d 
not  really  establish  the  "acceptable  unit"  criteria  that  is  required  in 
the  production  phase.  The  production  phase  controls  are  established 
(using  MIL-STD-105)  to  maximize  the  amount  of  hardware  accepted  for  use. 
The  delivered  quality  level  is  then  a function  of  the  Navy-imposed 
tolerances,  combined  with  the  quality  of  the  production  process.  If  the 
tolerances  are  too  stringent  the  hardware  will  be  more  expensive  than 
necessary  because  of  the  large  number  of  rejects  which  will,  in  turn, 
cause  more  careful  (expensive)  production  processes.  If  the  tolerances 
are  too  loose,  safety,  among  other  things,  will  suffer.  It  is  therefore 
necessary  to  devise  a test  program  which  will  provide  adequate  performance 
data  and  which  will  define  the  lower  quality  limits  that  will  meet 
performance  and  safety  requirements.  The  Faulty  Unit  Test  Concept  is 
that  type  of  test  program.  A case  in  point  is  the  recent  rash  of  5-in. 
in-bore  explosions  where  firing  of  1.8  million  5"/38  and  0.72  million 
f"/54  supposedly  acceptable  units  did  nothing  to  prevent  the  accidents 
or  to  aid  in  identifying  causes  and  corrective  action.  The  solutions 
arose  from  Faulty  Unit  type  of  testing  during  the  post-accident 
investigation. 
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WR-50  (Warhead  Safety  Tests  Minimum  for  Air,  Surface,  and  Under- 
water Launched  Weapons)  is  the  safety  testing  document  for  explosive 
units  and  has  been  relied  upon  for  many  years.  Using  test  units  rep- 
resentative of  production  hardware,  WR-50  requires  sequential  environ- 
mental overtesting  (vibration  and  temperature-humidity)  and  a destructive 
test  (40-ft  drop) , requiring  that  the  unit  be  safe  for  disposal. 

Further  destructive  testing  simulating  a fire  environment  (fast  and  slow 
cook-off)  is  conducted  to  ensure  that  initiation  of  the  explosive  does 
not  occur  at  too  low  a temperature.  WR-50  and  the  many  other  similar 
test  specifications  have  done  well  in  screening  out  initial  design  de- 
fects, but  they  do  not  address  the  errors,  omissions,  and  out-of-toler- 
ance  problems  which  are  passed  on  by  the  production  and  inspection  pro- 
cesses. 

Proof  testing  is  the  practice  of  subjecting  a unit  to  an  overtest 
of  its  normal  functioning  environment.  In  gun-fired  ammunition,  it  con- 
sists of  preparing  a special  propelling  charge  to  produce  a firing  cham- 
ber pressure  which  is  115  percent  of  maximum  allowable  service  pressure. 
This  test  provides  useful  design  assurance  but,  again,  does  not  attempt 
to  deal  with  defective  hardware  used  by  the  "customer"  under  normal 
service  conditions. 

Environmental  testing  (followed  by  functional  tests)  is  usually 
conducted  in  development  programs  to  assure  that  the  unit  will  function 
as  advertised.  Frequently,  effects  are  uncovered  which  will  adversely 
affect  safety.  These  safety  effects  lead  to  design  corrections  which  are 
important  to  the  user,  but  again  the  matter  of  defective  hardware  is 
usually  avoided. 


THE  FAULTY  UNIT  TESTING  CONCEPT 


The  Faulty  Unit  Testing  Concept  is  not: 

1.  A means  of  predicting  the  service  use  accident  rate  nor 
of  proving  that  the  accident  rate  will  be  loss  than  some  specified 
number. 


2.  A means  of  proving  that  a given  flaw  will  never  cause 
a safety  problem. 

3.  A practical  method  where  the  results  of  a flaw  or  failure 
can  be  precalculated  with  precision.  (Mechanical  devices  and  electrical 
circuits,  for  example,  are  usually  predictable  and  therefore  would  not 
ordinarily  require  testing  to  show  failure  consequences.) 
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4.  A substitute  for  normal  environmental  qualification  or 
for  a thorough  safety  engineering  analysis . 

5.  A means  of  uncovering  the  effects  of  anomalies  introduced 
by  factors  outside  the  "faulty"  test  unit;  that  is,  the  input  environ- 
ments must  be  known  and  controlled. 

In  contrast  to  the  previously  listed  items  of  what  the  concept  does  not 
provide,  the  following  is  a list  of  items  which  describe  what  the  concept 
is  and  what  it  will  provide.  The  concept: 

1.  Is  a rational  method  for  systematic  identification  of 
potential  accident  causr  , making  use  of  specific  design  data  pertinent 
to  the  hardware  to  be  L ted. 

2.  Is  open-ended  in  that  useful  data  can  be  obtained  from 
a limited  number  of  tests,  and  the  test  series  can  be  added  to  subse- 
quently for  additional  information.  The  extent  of  testing  is  limited 
only  by  time,  budget,  and  hardware. 

3.  Allows  one  to  recognize  the  value  in  "wasted"  tests, 
wherein  unintended  faults  or  errors  are  discovered  after  the  testing 
of  supposedly  perfect  hardware. 

4.  Works  well  in  evaluating  synergistic  fects  of  several 
flaws,  especially  when  used  in  "factorial"  type  > ^st  series.  The 
"factorial"  technique  has  the  advantage  of  allowiny  the  testing  of 
several  variables  for  a minimal  cost. 

5.  Can  provide  a rational  basis  for  establishing  allowable 
tolerances  for  safety-critical  parts  of  the  hardware  design. 

6.  Can  reduce  the  likelihood  of  future  accidents,  and  provide 
a good  data  base  for  planning  any  accident  investigations  which  might 

be  required.  By  having  data  available  on  the  consequences  of  various 
faults,  the  accident  investigation  can  be  oriented  quickly  into  profit- 
able areas  and,  if  the  cause  is  external  to  the  item,  this  fact  is 
likely  to  be  more  apparent  than  if  no  fault  consequence  data  were 
available . 


7.  Provides  a means  to  counteract  the  "negativistic  label" 
frequently  applied  to  safety  efforts.  Having  done  the  detailed  engi- 
neering work  with  the  drawings  to  select  and  size  the  faults,  and  later 
having  demonstrated  the  reality  of  the  hazard,  communication  and  co- 
operation between  safety  engineers  and  designers  is  much  improved. 

In  some  cases  at  NSWC/DL,  the  designers  thus  "educated"  have  surpassed 
the  safety  engineer  in  their  zeal  to  eliminate  hazards. 


4 


ASSUMPTIONS  AND  GROUND  RULES 


Prior  to  detailed  planning  of  fault  testing,  thorough  safety 
analysis  should  be  accomplished  ' clearly  identify  both  hazards  and 
potential  causes  for  those  hazards . 


As  previously  mentioned,  faulty  unit  testing  is  usually  imprac- 
tical where  the  results  can  be  precalculated  with  certainty.  Most 
mechanical  devices  and  electrical  circuits,  for  example,  are  usually 
predictable  and  therefore  seldom  require  verification  testing  of  this 
sort.  Explosives,  on  the  other  hand,  are  not  sufficiently  understood 
to  allow  precalculation  of  the  effects  of  various  flaws  when  subjected 
to  severe  environmental  stress. 


In  the  case  of  explosives,  an  energy  input  is  assumed  to  be  the 
cause  of  any  reaction,  and  the  relationship  between  probability  of 
reaction  and  energy  input  per  unit  volume  is  assumed  to  be  of  the  form: 
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Specific  manufacturing  flaws  which  have  the  potential  for  causing 
an  energy  input  must  be  identified.  Examples  include  cracks,  gaps,  voids, 
low-density  areas  within  explosives,  and  dimensional,  assembly,  and 
materials  variations  in  formed  parts. 

Flaws  and  faults  fall  into  two  general  categories:  component 

omission  and  variable  magnitude.  In  the  case  of  component  omission, 
there  is  no  meaningful  intermediate  state  between  flaw  and  no  flaw. 

In  the  variable  magnitude  case,  it  generally  becomes  clear  that  there 
is  a (dimensional)  condition  where  no  hazard  is  expected  and  where 
departure  from  that  state  in  one  direction  moves  toward  increased 
probability  of  hazard.  Testing  of  the  missing  component  type  is 
relatively  simple,  but  testing  of  the  variable  magnitude  type  may 
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involve  testing  at  several  levels.  Hopefully,  one  will  be  able  to 
select  an  extreme  value  of  a variable  magnitude  flaw  which  produces 
no  hazard. 

Careful  consideration  must  be  given  to  the  stress  levels  at  which 
the  testing  is  to  be  performed.  If  overtesting  (above  the  normal  service 
level)  is  to  be  done,  one  should  be  sure  that  the  overtest  actually 
increases  the  probability  of  getting  results.  In  some  cases  in  gun 
ammnuition  testing,  the  standard  methods  for  overtesting  will  actua’ly 
reduce  the  particular  condition  contributing  to  the  explosive  initiation. 
A good  rule  of  thumb  is  to  avoid  departing  from  service  conditions 
unless  you  have  positive  knowledge  that  you  are  gaining  more  useful 
information  by  so  doing. 


OBTAINING  AND  USING  THE  RESULTS 


Figure  1 is  a flow  diagram  which  illustrates  the  actions  and 
decision  points  inherent  in  a sample  fault  testing  program. 

Selection  of  the  number  of  units  to  be  tested  is  usually  driven 
very  strongly  by  economics.  The  safety  investigator  requires  some 
rather  detailed  arguments  in  order  to  obtain  a reasonable  quantity  of 
hardware  and  money  for  safety  test  purposes. 

Anticipating  the  arguments  in  favor  of  dealing  with  safety  problems 
after  they  are  discovered  during  service  use.  Figure  2 illustrates  the 
effectiveness  with  which  inspections  can  be  conducted  to  find  a small 
number  of  defectives  in  a large  group  of  units.  It  is  apparent  that 
nearly  100-percent  inspection  is  required  to  find  all  the  defectives. 
This  has  great  economic  impact,  after  many  units  are  out  in  the  Fleet, 
when  a small  number  of  safety  defects  are  thought  to  be  present,  and 
it  is  desired  to  screen  these  defects  out  before  the  first,  or  another, 
accident  is  caused.  Even  simple  inspections  of  a large  number  of  units 
are  very  costly;  thus  one  advantage  of  an  early  fault  testing  program 
is  to  provide  some  data  to  aid  in  the  decision  about  whether  the  cost 
of  screening  is  justified. 

Table  1,  a standard  table  which  is  available  in  most  reliability 
references,  provides  some  indication  of  how  much  engineering  confidence 
can  be  gained  from  testing.  For  example,  the  table  indicates  that  if  a 
95-percent  confidence  level  is  desired  and  29  unirs  are  tested  experi- 
encing no  failure  (reaction  in  the  explosive  fault  test  case) , no  more 
than  10  percent  failures  would  be  expected  in  a test  of  a large 
random  sample,  configured  identically.  The  reliability  of  .9  in 
this  case  is  the  reliability  of  the  (no  failure)  result  at  the 
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Figure  I.  Sample  Faulty  Unit  Program  Flow  Diagram 
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Table  1.  Number  of  Tests  Without  Failure  Versus  Reliability 
and  Confidence  (Binomial  Distribution) 


Reliability 

50 

60 

Confidence 
70  80 

Level  (%) 
90 

95 

99 

% 

.9999 

6,932 

9,163 

12,040 

16,094 

23,026  29,957 

46,052 

.999 

693 

916 

1,204 

1,609 

2,303 

2,996 

4,605 

.998 

347 

458 

602 

805 

1,152 

1,498 

2,303 

.997 

231 

305 

401 

537 

768 

999 

1,535 

.996 

173 

229 

301 

401 

575 

747 

1,149 

.995 

138 

183 

241 

321 

460 

598 

920 

.994 

115 

152 

201 

267 

383 

498 

765 

.993 

99 

130 

174 

229 

328 

427 

657 

.992 

86 

114 

150 

200 

287 

373 

574 

.991 

77 

101 

134 

178 

255 

332 

510 

.99 

69 

92 

120 

160 

229 

298 

459 

.98 

34 

45 

60 

80 

114 

149 

228 

.97 

23 

30 

40 

53 

76 

99 

151 

.96 

17 

23 

30 

39 

57 

74 

113 

.95 

14 

18 

24 

31 

45 

53 

90 

.94 

11 

15 

20 

26 

37 

49 

75 

.93 

10 

13 

17 

22 

32 

42 

64 

.92 

9 

11 

15 

19 

28 

36 

55 

.91 

8 

10 

13 

17 

25 

32 

49 

.90 

7 

9 

12 

15 

22 

29 

44 

.89 

6 

8 

U 

14 

20 

26 

40 
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6 

8 

10 

13 

18 

24 

36 
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5 

7 

9 

12 

17 

22 

33 
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5 

7 

8 

11 

16 

20 

31 

.85 

5 

6 

8 

10 

15 

19 

29 

.80 

3 

4 

6 

7 

11 

14 

21 

.75 

3 

4 

5 

6 

8 

11 

16 

.70 

2 

3 

4 

5 

7 

9 

13 

.65 

2 

2 

3 

4 

6 

7 

11 

.60 

2 

2 

3 

4 

5 

6 

9 

.50 

1 

2 

2 

3 

4 

5 

7 

99.9 


69,078 

6,908 

3,454 

2,303 

1,723 

1,379 

1,148 

985 

860 

764 

688 

342 

227 

170 

135 

112 

96 

83 

74 

66 

60 

54 

50 

46 

43 

31 

24 

20 

16 

14 
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95-percent  confidence  level.  By  using  this  sort  of  information  in 
the  context  of  the  program's  economic  limitations,  more  rational 
tradeoffs  can  be  made  to  obtain  reasonably  sized  test  programs. 

Figure  3 presents  information  of  both  an  encouraging  and  dis- 
couraging nature.  On  the  discouraging  side,  it  illustrates  that  if 
the  reaction  being  investigated  does  not  always  occur  when  the  fault 
is  present  (a  low  true  probability  of  failure)  it  may  take  a very 
large  number  of  tests  to  uncover  it.  On  the  encouraging  side,  if 
a fault  test  of  a few  units  does  produce  a reaction,  it  confirms  that 
there  is  a significant  real  probability  of  a reaction  occurring  if 
this  fault  shows  up  in  service  use.  The  major  value  of  this  sort  of 
information  is  to  make  the  safety  engineer  more  aware  of  the  economic 
tradeoffs  and  the  overall  significance  of  the  test  results. 

The  action  to  be  taken  on  the  basis  of  Faulty  Unit  Test  results 
is  clearly  one  of  the  most  troublesome  aspects  of  the  whole  endeavor. 

At  this  writing,  it  is  believed  that  mere  suspicion  that  a fault  is  a 
potential  hazard  calls  for  inspection  of  the  production  units  (for 
that  fault)  to  at  least  a "critical"  level  (0.065  AQL) . This  inspec- 
tion should  occur  whether  or  not  any  hazardous  events  are  produced  in 
the  test  program.  On  the  other  hand,  reactions  produced  in  the  test 
programs  call  for  the  creation  of  a "super  critical"  category  entailing 
100-percent  inspection  of  production  units  to  screen  out  the  prescribed 
flaws.  In  the  case  of  variable  magnitude  flaws,  it  is  intended  to 
first  test  exaggerated  (4-  to  6-Sigma  size)  flaws  to  determine  whether 
an  event  can  be  produced.  If  a reaction  occurs,  reduced  severity  flaws 
will  be  tested  until  no  event  is  produced  (in  a 30-unit  test) . The 
100-percent  production  inspection  requirement  will  then  be  established 
to  screen  out  flaws  greater  than  half  the  size  or  severity  of  the  one 
that  finally  produced  no  hazardous  event.  Figure  2 offers  a convenient 
graph  for  assessing  the  effectiveness  of  inspection  in  weeding  out 
faulty  units  if  they  are  randomly  dispersed  in  the  production  run. 

The  graph  makes  no  allowance  for  inspection  error  (human  inspectors 
are  not  perfect,  and,  despite  the  scarcity  of  data,  it  has  been  assumed 
that  an  "average"  inspector  would  detect  only  80  percent  of  the  faulty 
units  that  pass  through  his  inspection) . 

In  the  case  of  "variable  size"  faults,  the  process  for  selecting 
the  size  of  the  flaw  is  an  exercise  in  engineering  judgment.  Because 
a test  must  be  conducted  before  adequate  part  manufacturing  history 
has  been  generated,  the  best  information  available  must  be  used  with 
caution . 

The  magnitude  of  expected  manufacturing  flaws  can  be  crudely 
estimated  from  manufacturing  drawings  during  development,  more 
accurately  from  subsequent  production  experience,  or  from  the  history 
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TRUE  PROBABILITY  OF  FAILURE 


10°- 


PROBAB1UTY  OF  AT  LEAST  ONE  FAILURE  SHOWING  UP  IN  THE  TESTED  SAMPLE 

Figure  3.  Relationship  Between  the  Real  Probability  of  Failure  and 
the  Likelihood  of  Experiencing  Failure  in  Testing  Various 
'Numbers  of  Items 
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of  similar  manufacturing  techniques.  In  the  absence  of  better  infor- 
mation about  the  magnitude  and  frequency  of  dimensional  flaws,  the 
manufacturing  drawing  tolerances  may  be  assumed  to  represent  3-Sigma 
values  in  a normal  distribution.  Some  assumption  of  this  sort  is 
required  in  order  for  testing  to  provide  timely  feedback  to  a develop- 
ment program.  Assuming  that  the  drawing  tolerances  are  3 Sigma,  in 
a normal  distribution,  the  value  of  1 Sigma  can  be  obtained  by  dividing 
by  3.  Since  the  range  from  -1  Sigma  to  +1  Sigma  is  a dimensional 
value  that  includes  68.26  percent  of  the  observed  cases,  -2  Sigma  to 
+2  Sigma  includes  95.46  percent  etc.,  it  follows  that  by  deciding  what 
probability  level  (of  experiencing  the  flaw  in  service  use)  one  wants 
to  consider,  Figure  4 can  be  used  to  determine  the  number  of  Sigmas,  and 
thus  the  dimensions  necessary  for  creation  of  the  test  flaws.  Because 
selecting  the  flaw  size  to  be  tested  necessitates  assumptions  about 
the  quality  of  future  production,  careful  thought  should  be  devoted 
to  the  matter  since  a small  error  in  the  value  of  Sigma  is  multiplied 
when  the  flaw  size  is  chosen.  Appendix  A contains  samples  and  illus- 
trative examples  of  the  selection  of  flaw  sizes  and  the  use  of  results. 

One  area  of  free  safety  information  frequently  arises  where, 
after  a nonsafety  test  is  finished,  it  is  discovered  that  a disquali- 
fying defect  was  present.  The  normal  program  reaction  is  to  consider 
it  a "no  test"  and  never  mention  it  again.  The  "fault  test  engineer" 
should  be  alert  for  these  unintended  fault  tests  since  they  may  be 
a significant  addition  to  the  faulty  unit  data  base.  In  the  program 
which  inspired  this  report  there  were  390  intended  fault  tests  and 
280  unintended  "free"  tests! 


12 


2 


3 


5 


6 


PROBABILITY  OF  A VALUE  FALLING  OUTSIDE 
THE  ZONE  BOUNDED  BY  + K a AND  -Ka 

(THIS  PROBABILITY  IS  TWICE  THE  VALUE  OF 
THE  OTHER  CURVE  SINCE  IT  INCLUDES 
BOTH  THE  HIGH  SIDE  AND  THE  LOW  SIDE 
— OUT  OF  TOLERANCE  CONDITIONS) 


PROBABILITY  OF  THE  VALUE  ^ 
BEING  EITHER  GREATER  THAN  - 
THE  + Ka  LIMIT  OR  LESS  THAN 
THE  -Ka  LIMIT 
(ONE  OR  THE  OTHER,  NOT  BOTH 


K STANDARD  DEVIATIONS  (a) 


Figure  4.  The  Relationship  Between  Standard  Deviations  and  Their 
Numerical  Probability  Values 
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APPENDIX  A 
APPLICATION  EXAMPLES 


SIZING  OF  FAULTS 


As  discussed  in  the  text  covering  flaws  with  various  possible 
sizes,  a means  of  deciding  the  flaw  size  for  the  test  must  be  developed. 
One  means  of  doing  this  is  as  fellows: 

1.  To  determine  a test  configuration  for  evaluating  the  gun- 
fire consequences,  to  the  contained  explosive,  of  a step  existing  where 
the  forward  and  aft  projectile  body  sections  join  (Reference  NSWC/DL 
EPT  Dwg  1842) . 


LOCATION  Of  THE  STEP 


+.007 
.027  in. 


SOURCES  OF  THE  STEP 

1.  CENTERLINE  MISALIGNMENT 
BETWEEN  FORWARD  AND 
AFT  SECTIONS  (DRAWING 
ALLOWS  .020  ") 

2.  INTERIOR  CAVITY  DIAMETER 
DIFFERENCES  BETWEEN 
FORWARD  AND  AFT  SECTIONS 
(DRAWING  ALLOWS  .007" 
DIFFERENCE! 


Assume : 

a.  Normal  distribution  of  dimensions  about  the  mean, 

b.  Random  assembly  of  parts,  and 

c.  Drawing  tolerances  represent  3 -sigma  values. 
Using  Figure  4: 


3-Sigma  Case  4 -Sigma  Case 


Probability  of  fwd  section 

1.4*10“ 3 

3 ' 10~  5 

being  large 

— 3 

-5 

Probability  of  fwd  section 

1.4-10 

3-10 

having  centerline  misaligned 

— 3 

-5 

Probability  of  aft  section 

1.4-10 

3*10 

being  small 

_ o 

— 5 

Probability  of  aft  section 

1.4-10 

3-10 

having  centerline  misaligned 
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Probability  of  combining  large  forward  section  and  small  aft  section 
(maximum  radial  difference) 

Pr  (3-Sigma  case  fwd  & aft)  = 1.4*10  J x 1.4*10  3 = 1.96*10  6 
Pr  (-4 -Sigma  case  fwd  & aft)  = 3*10  5 x 3*10  5 = 9*10  10 
Probability  of  having  both  forward  and  aft  section  centerlines 
misaligned  (maximum  misalignment) 

Pm (3 -Sigma  case  misalign)  = 1.4*10~3  x 1.4*10~3  = 1.96*10-6 
Pm (4-Sigma  case  misalign)  = 3*10  5 x 3*10  5 = 9*10-10 
Probability  of  having  both  maximum  radial  difference  and  maximum 
misalignment  coexisting 

Pt  (for  3-Sigma  case)  = 1.96_^10  6 x 1.96*10  6 = 3^84*10  12 
Pfc  (for  4-Sigma  case)  = 9*10  10  x 9*10  10  = 81*10  20 

Note:  The  additional  factor  of  the  likelihood  of  having  the  centerline 

misalignments  exactly  opposite  instead  of  on  the  same  side  is 
being  ignored  for  simplicity. 

Conclusion:  Compared  to  the  often  quoted  safety  number  of  1*10  6, 

selection  of  the  4-Sigma  dimension  appears  to  be  an  extreme  enough 
choice  for  testing. 

Calculate  the  4-Sigma  dimensions: 

Total  of  3-Sigma  dimensions  = 0.027  in. 

Total  of  4-Sigma  dimensions  = 0.027  • 4_  = 0.036  in. 
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2.  To  provide  a single  test  to  evaluate  both  a forward 
facing  lip  and  a rear  facing  lip,  machine  .036  in.  from  one  side  of 
the  forward  and  one  side  of  the  aft  section  and  assemble  so  that  the 
machined  areas  are  on  opposite  sides  of  the  projectile.  Machine 
in  accordance  with  NSWC/DL  Dwgs  40314C  and  40315C. 


OVERALL  FAULT  TESTING  RESULTS 


In  an  explosive-loaded  gun  ammunition  development  program  ex- 
tending over  several  years  and  several  types  and  calibers  of  projectiles, 
a total  of  over  2000  rounds  were  gunfired  with  the  same  explosive.  Of 
this  number,  390  contained  various  deliberately  induced  faults  which  were 
fired  tor  safety  investigations.  Fifty-two  premature  (unsafe) 
reactions  occurred  and  their  causes  identified.  Additionally, 
another  280  faulty  rounds  were  fired  wherein  the  faults  were  unexpected, 
having  been  accidentally  introduced  during  manufacture  or  environmental 
testing.  Upon  gunfire,  10  of  these  gave  premature  reactions  for  which 
examination  of  the  fault  condition  provided  reasonable  correlation 
with  the  premature  causes  in  the  deliberate  cases. 
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Appendix  B contains  a copy  of  a memorandum  citing  the  conclusions 
drawn  near  the  end  of  the  above  program.  In  this  case  the  fault 
testing  was  found  to  be  very  helpful  in  the  decision  making  process. 
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APPENDIX  B 


FAULT  TEST  RESULTS 


NAVAL  SURFACE  WEAPONS  CENTER 
HEADQUARTERS 

white:  oak,  silver  spring,  Maryland  20910 


WHITE  OAK  LABORATORY 
SILVER  SPRING,  MO.  20910 
AREA  CODE  202 
394  - EXT. 

AUTOVON  290  ♦ EXT. 


OAHI.GREN  LABORATORY 
OAHLGREN,  VA.  22448 
AREA  CODE  703 
663  - EXT.  8171 
AUTOVON  249  ♦ £XT.  8 I 7 I 

IN  REPLY  REFER  TO: 

ESE: JSNrdcn 
8000 

Ser:  07*1300 

17  October  197* 
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MEMORANDUM 


From:  ES 

To:  GW  (Klaus) 


Subj : 


of  two  piece  projectiles  with 
Explosive  (U) 


Enel:  (l)  Safety  Non-Problems 

(2)  Possible  Premature  Reaction  Causes 

(3)  Identified  Premature  Reaction  Causes 

(If)  Gunfire  Experience  wlthBHIHft  Loaded  Projectiles 
(5)  HM  Faulty  Ammunition  Firings  - Projectile  Flaws, 
Explosive  Flaws,  Single  Assembly  Flaws,  Hultlple 
Assembly  Flaws 


1.  (U)  It  is  the  purpose  of  this  memo  to  collect  and  discuss  the  safety 

lessons  we  have  learned  through  the  extensive  testing  of  the  subject 
explosive  In  various  projectile  configurations.  In  order  to  simplify 
a very  complicated  set  of  data,  the  test  results  will  be  broken  down  Into 
three  categories;  those  clearly  demonstrating  no  safety  problems,  those 
demonstrating  possible  problems  and  those  demonstrating  definite 
problems.  Accordingly,  enclosures  (I)  - (3)  will  discuss  the  test  results 
In  that  order.  Enclosures  (4)  and  (5)  are  complete  listings  of  the  total 
gunfire  and  faulty  round  firings,  respectively. 


2.  (U)  Some  of  the  following  terms  have,  over  the  years  been  synonymous 
with  destructive  projectile  accidents.  As  used  herein,  this  is  not  the 
case,  therefore,  the  definitions  are  as  follows: 


Premature  Reaction  - Initiation  of  a burning  reaction  in  the  projectile 
explosive  prior  to  the  expected  fuze  function.  The  results  of  this 
burning  are  non-destructive  and  non-violent,  except  where  noted.  In  both 
two  piece  and  conventional  projectiles,  unless  detonation  Is  achieved, 
the  firing  sf  •)  will  often  be  unaware  of  its  occurrence. 
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Detonation  - An  explosion  chariieterized  by  propagation  of  the  reaction 
front  at  supersonic  velocity  (within  the  reacting  medium)  and  motion  of 
the  reaction  products  in  the  same  direction  as  the  reaction  front. 

Detonation  results  in  projectile  break  up  Into  small  fragments  traveling 
at  2000  to  3500  fps.  If  it  occurs  inside  a gun  barrel,  barrel  fracture 
occurs  (in  greater  than  3 inch  gun  sizes),  and  tne  subsequent  large  fragments, 
hot  gas  and  shock  waves  cause  further  destruction  and  crew  injury. 

Transition  from  Burning  to  Detonation  - The  condition  where  burning 
can  give  rise  to  a shock  wave.  This  only  jccurs  when  pressure  rises 
exponentially  in  a few  microseconds  to  several  thousand  atmospheres 
and  coalescence  of  pressure  waves  gives  rise  to  a shock  wave. 

3.  (U)  In  prior  experience  withflHHH,  all  premature  reactions  were 

classified  as  "in-bore".  The  photographic  indications  of  this  type  are 
visible  and  distinct  separation  of  projectile  pieces  as  soon  as  they 
emerge  from  the  smoke  at  the  muzzle.  In  the  128  round  factorial  test  of 
the  round , unusual  out-of-bore  prematures  were  experienced. 

Upon  emergence  from  the  muzzle  smoke,  at  about  25  feet  out,  the  projectile 
parts  were  still  attached  together.  In  subsequent  photos,  the  projectile 
could  be  seen  to  separate,  achieving  complete  separation  by  about  75  feet. 
These  reactions  were  characterized  by  much  less  vigorous  burning  of  the 
explosive,  than  the  inbore  reactions,  once  the  projectile  opened.  As 
with  the  in-bore  reactions,  the  out-of-bore  prematures  were  non-destructive. 

**.  (U)  The  purpose  of  the  safety  investigation  was  to  categorize  the 

safety  consequences  of  projectile  flaws.  Table  1 indicates  the  categories 
of  the  flaws,  which  are  discussed  in  detail  in  enclosures  ( 1 ) — (3) . 
Collectively,  the  safety  results  may  be  summarized  as  follows: 

a.  HHB  seems  less  likely  to  have  a burning  reaction  transition 
to  detonation  than  Comp  A”3  explosive.  In  62  premature  reactions,  only 
one  round  experienced  any  detectable  detonation,  in  this  case  only  a 
small  portion  of  the  burning  explosive  charge  achieved  detonation  during 
an  overpressure  rupture  of  the  gun  barrel  (the  detonation  is  not  thought 
to  have  caused  the  rupture).  Another  round  (with  the  same  flaw  responsible 
for  the  above  incident)  resulted  in  a relatively  non-violent  split  in  the 
gun  barrel  due  to  ovtrpressurization.  The  remaining  60  premature  reactions 
were  limited  to  burning  with  consequent  nori-violent  opening  of  the 
projectile  and  result  ng  in  ho  gun  damage.  Comp  A-3  on  the  other  hand 
has  experienced  79  premature  reactions  (exclusive  of  fuze  caused  prematures) 
from  1950  to  197**  in  5"/33  and  5"/5**  guns,  37  of  which  were  low  order 
(non-violent)  reactions  and  **2  of  which  were  high  order,  destructive 
reactions.  Host  of  these  events  occurred  in  the  5"/38  guns  while  three 
occurred  in  5"/5**  guns,  two  high  order  and  one  low  order. 
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Table  1 


SAFETY  CATEGORY  OF  PROJECTILE  FLAWS 


Safety  Non-Problems  (See  Enclosure  (1)) 

Enlarged  Cavity  Base  Diameter  (Forging  Flaw) 

Misal igned  Cavity 

Hot  Gas  Leakage  (Through  Projectile  Hid-Body  Joint) 
Water  In  Explosive  Cavity 

Possible  Premature  Reaction  Causes  (See  Enclosure  (2)) 


Cracked  Encapsulant 

Excessive  Explosive  Radial  Clearance 

Uncured  Explosive 

Identified  Premature  Reaction  Causes  (See  Enclosure  (3)) 
Holes  In  Projectile  Base 
Joint  Rotation 
Large  Bubbles 
Base  Gaps  or  Base  Cracks 
Small  Bubbles  and  Base  Gaps 
HTPB  Encapsulant 
Sawed  Explosive  Nose  Surface 
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b.  Experience  to  date  Indicates  that  Comp  A~3  is  subject  to 
premature  initiation  only  when  the  explosive  load  is  insufficiently  pressed, 
giving  a low  density.  In  this  condition  a circumstance  of  a base  gap  or 

an  excessive  gunfire  shock  input  can  result  in  a premature  reaction,  which 
can  remain  low  order  or  proceed  to  a detonation,  as  previously  discussed. 

c.  MMHHHcan  be  prematurely  initiated,  in  the  flflMi 
configuration,  by  hot  gas  leakage  through  holes  in  the  projecti le  base, 
relative  rotation  of  the  forward  and  aft  projectile  body  sections 
(knurling  being  the  major  control  feature),  large  (>  1/4  inch)  bubbles 
or  voids  in  the  explosive  and  base  area  anomalies  (gaps,  failed  adhesive 
or  missing  adhesive).  Admittedly,  this  is  a longer  list  of  potential 
causes  than  for  Comp  A-3  and  quality  assurance  will  need  to  be  rigorous  to 
eliminate  them.  The  safety  trade-off  question  is  whether  the  lower 
proability  of  transition  to  detonation  oFBMBBfout*~weighs  its  greater 
number  of  initiation  sources. 

d.  The  major  unknown  areas  at  this  time  are  the  changes  in  base 
anomaly  effects  due  to  the  MHH  hemispherical  cavity  base  (the|H 
■■■■  base  was  relatively  flat)  and  the  use  of  cross-linked  polyethylene 
encapsulant  (vice  ethyl  cellulose)  and  the  frequency  of  the  premature 
causing  flaws  in  ammunition  delivered  to  the  fleet.  The  changes  in  the 
hardware  design  will  be  evaluated  in  a factorial  test  during  TECHEVAL 

and  estimates  of  flaw  frequency  will  be  developed  using  TECHEVAL  hardware 
production  for  a data  base. 

5.  (U)  The  findings  of  the  safety  investigations  thus  far  indicate  that 

continuation  into  TECHEVAL  is  justified.  The  safety  investigations 
during  TECHEVAL  should  be  especially  directed  toward  the  understanding  and 
resolution  of  the  base  anomaly  problems. 


S.  H.  McELROY , Head 
Weapons  Safety  Division 


Copy  to: 

E 

ES 

^ESE  (5) 

-7G 

GW 

GW  (Heard) 
TPD  (Hughes) 
EJP  (Edgell) 
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NAVAL  SURFACE  WEAPONS  CENTER 

HEADQUARTERS 


white  oak  laboratory 

SILVER  SPRING,  MO.  20910 
(202)  394  - 


WHITE  OAK,  SILVER  SPRING,  MARYLAND  20910 

DAHLGREN  LABORATORY 
DAHLGREN,  VA.  22448 
(703)  663— 


IN  REPLY  REFER  TO: 

DX-43 :GMG:bar 
25  January  1977 


From:  Commander,  Naval  Surface  Weapons  Center,  Dahlgren  Laboratory 

(Code  DX-40) , Dahlgren,  Virginia  22448 
To:  Distribution 

Sub j : Pen  and  Ink  Corrections  to  Unclassified  NSWC/DL  Technical 

Report  TR-3478,  Underlying  Concepts  and  Assumptions  for  Faulty 
Hardware  Safety  Testing,  dated  August  1976 


1.  The  following  pen  and  ink  changes  should  be  made  to  the  subject 
technical  report: 


a.  Front  cover — Change  TR  number  from  "TR-3478"  to  "TR-3602" 

b.  DD  Form  1473— Change  TR  number  from  "TR-3478"  to  "TR-3602" 


2.  This  correction  notice  should  be  attached  to  the  inside  front  cover 
of  the  subject  technical  report. 


K.  G.  McCOLLUM 
By  direction 


REPRODUCED  BY 

NATIONAL  TECHNICAL 
INFORMATION  SERVICE 


i/n  miiMi.m  ui  VUIl  T LltliL 

SPRINGFIELD.  VA.  2216! 


